Workspace and supported Sandbox profiles
Connect your agents.
Keep payment authority intact.
Start with one workflow and its original approval. Assign the work, verify the handoff and review the installed execution boundary.
Free Sandbox · No card required · Financial operating approval is separately qualified
Choose the right starting point.
Use Workspace to set up a company workflow. Use the public SDK exercise to learn the local Payment API contract. SDK installation is optional for the Workspace example and supplies no hosted payment account or installed Agent runtime.
Start in Workspace.
Explore the guided example, then prepare one supported Sandbox source, its original approval and enrolled Agents.
Start free → Separate API exerciseRun the SDK fixture.
Run the fixed USD 10 HTTP recovery exercise with Python or JavaScript. No account, provider credentials or real funds.
Open the SDK quickstart →The browser and guided examples are synthetic learning. Their completion does not verify your installation or connect a bank.
Bring the people and access you need.
| Owner | Prepare |
|---|---|
| Company Owner | A company Workspace, current membership and any required MFA. Keep the environment on Sandbox. |
| Source administrator | Authorized access to the supported BILL Sandbox organization and one exact invoice, including its version and terms. |
| Financial approver | The separately signed original financial approval and its retained owner, Authority and Obligation identities. Invoice access and company membership cannot issue this approval. |
| Integration engineer | The reviewed host profile, independent trust pins and separately enrolled Agent keys. Each Agent keeps its own private signing key. |
| Verification and operations owners | The original records, independent evidence review and responsibility for recovery and any later operating qualification. |
Company-specific host enrollment and execution setup require the supported installed profile. A package download does not provision them. If an enrollment or host is unavailable, retain that blocker and agree the setup with the integration owner.
Keep source tokens, provider credentials and private keys in their approved private custody. Do not include them in documentation examples, support messages or downloaded evidence.
Connect one workflow to its original.
- Create your company Sandbox. Sign in with Google or an email code. Use the guided example to understand the flow before configuring your own source.
- Select the source. In Connections, configure the supported BILL Sandbox source using its access requirements. Choose one invoice in Workflows and check the organization, invoice version, currency and amount.
- Retain original authority. Bind that exact invoice to its separately approved original financial owner. Preserve the original Authority and Obligation IDs, approval and complete history. Ask the financial approver to resolve a missing approval.
Source access is separate from financial approval. Reading an invoice establishes source evidence. A Workspace role, invoice amount or successful connection cannot create a right to pay.
Change the Agent. Keep the original.
- Assign Agent A. Choose an enrolled Agent in the supported profile and use Assign to Agent. Its assignment scopes the review work to the retained original.
- Verify the work. Agent A supplies its own signed receiving proof and the required independent work evidence. A missing, rejected or expired proof stays visible.
- Preview the handoff. Review what access changes and what authority stays, then confirm the transfer. The original owner fences A; B remains receipt-pending until it supplies its own fresh signed receiving proof.
- Check continuity. Verify B's work and retained history. Late A access is refused in the supported profile. Check the same original after restart rather than initializing another owner.
The Workspace assignment transfers read/review work and preparation of a draft. Receiving proof and verified work do not authorize payment execution. A separate installed composition must connect an execution request to the original financial engine.
Verify the exact execution boundary.
With the installation owner, bind the reviewed host and code to the same company, workflow, original financial owner, retained stores, Agent keys and declared payment routes. Use independently obtained profile and package pins.
The controlled installed BILL profile connects a signed Agent request to the existing original financial engine. The current release-perimeter profile additionally checks the reviewed code, account, credential identities, gates and fresh installation evidence before a new effect. These profiles require explicit installation and their own qualification.
- UNKNOWN
- The original may still pay. Keep its reservation and HOLD a replacement through handoff and restart.
- PAID
- The original has consumed the authority. REFUSE a second full-principal payment.
- CLOSED
- Authoritative evidence must exclude any later original effect. A replacement still needs a newer signed approval after closure and a fresh complete decision.
Missing or expired required installation evidence keeps a new release on HOLD. It does not close the original or restore capacity. After a lost reply, look up and recover the exact original; do not send a new financial request to discover what happened.
Review installed evidence and its limits · Understand the control model
Keep the next action explicit.
Use Home for attention items, Workflows for the selected work, Evidence for supporting records and Connections for source and execution setup. Review the exact profile and original identities with every result.
| Current condition | Owner and next action |
|---|---|
| Original approval missing | Financial approver: supply the independently approved original and its history. |
| Agent B receipt pending | Agent integration owner: obtain B's own valid receiving proof. Keep A fenced. |
| Installation evidence expired | Installation owner: renew the inspection against the same reviewed configuration. Requalify any configuration change. |
| Original outcome UNKNOWN | Recovery owner: resolve the exact original using authoritative evidence. Keep replacement capacity reserved. |
These are guidance examples, not live account statuses. A missing observation remains incomplete. An independent historical verification checks captured evidence; it does not renew access or grant current payment permission.
Agree the scope before operations.
The supported controlled Sandbox profiles, the separate Increase Sandbox reference and the public SDK fixtures have different evidence. A passing result in one does not qualify another.
Customer acceptance, native execution and financial Production remain separately gated. Qualify provider evidence and closure semantics, every included release path, credential custody, recovery, security and operational ownership before requesting operating approval. Hidden/manual paths and customer cloud IAM need their own evidence.
Current scoped evidence · Security and trust boundaries · Pricing and qualification